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Abstract 

In a case study we investigate whether off the shelf higher-order theorem provers and model 
generators can be employed to automate reasoning in and about quantified multimodal logics. 
In our experiments we exploit the new TPTP infrastructure for classical higher-order logic. 
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1 Introduction 

This paper presents a case study in quantified multimodal logics. An interesting aspect of this 
case study is that off the shelf theorem provers and model generators for simple type theory, that 
is, classical higher-order logic, are employed to automate problems in quantified multimodal log- 
ics, that is, non-classical logics. This is enabled by our recent embedding of normal quantified 
multimodal logics in simple type theory [8, 10], which is sound and complete [10]. Interestingly, 
not only reasoning within various non-classical logics can be automated this way but also rea- 
soning about them. For example, the equivalence between different properties of accessibility 
relations and their associated multimodal axioms can be proved automatically. 

Generally, it seems that proof assistants and automated reasoning systems for classical higher- 
order logics can serve — ideally in combination — as a fruitful basis for the exploration and the 
modeling of normal multimodal logics, for the investigation of their meta-properties, and proba- 
bly even for the application of these logics to real world problems. In fact, normal multimodal log- 
ics are simply fragments of classical higher-order logics with specific computational properties. 
Detecting and characterizing these fragments, in particular decidable ones, can be very beneficial 
for the higher-order reasoners themselves, since this may stimulate significant improvements of 
the reasoning procedures used within these reasoners. 

The modeling of a specific propositional or quantified multimodal logic of interest in our 
framework is straightforward and not very time consuming. This is in contrast with the usual 
situation in the area of quantified and propositional multimodal logics, where a vast amount of 
specific calculi have been developed and published, while very few of them have actually been 
implemented and applied. The main reason is that the effective implementation of these calculi is 
usually non-trivial. 

The paper is structured as follows: In Section 2 we present some preliminaries and our em- 
bedding of quantified multimodal logic into simple type theory. The new content, our small but 
interesting case study, is presented in Section 3 and an outlook is presented in Section 4. 1 



'Initially our plan was to extend the case presented here to propositional and quantified temporal logics. A study 
in (quantified) temporal logics will thus remain future work.) 
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2 QMC as a fragment of STT 

STT [15] is based on the simply typed A-calculus. The set T of simple types is usually freely 
generated from a set of basic types {o, i} (where o is the type of Booleans and i is the type of 
individuals) using the function type constructor Instead of {o, i} we here consider a set of 
base types {o, i, /i}, providing an additional base type /i (the type of possible worlds). 

The simple type theory language STT is defined by (a, j3 E T): 

s,t ::= p a | X a | (\X a .sp) a ^p \ (s a ^pt a )p \ (^ ^ s )o | 

p a denotes typed constants and X a typed variables (distinct from p a ). Complex typed terms 
are constructed via abstraction and application. Our logical connectives of choice are -i -> , 
Vo^,,, = a ^a->o and Il( a ^ )^ (for each type a). 2 From these connectives, other logical con- 
nectives can be defined in the usual way (e.g., A and =>- ). We often use binder notation VX a . s 
for II( Q ,^ )_ >0 (AX Q . s a ). We assume familiarity with a-conversion, (3- and ^-reduction, and the 
existence of (3- and /^-normal forms. Moreover, we obey the usual definitions of free variable 
occurrences and substitutions. 

The semantics of STT is well understood and thoroughly documented in the literature [2, 3, 
7, 19]. The semantics of choice for our work is Henkin semantics. 

QMC has been studied by Fitting [16] (further related work is available by Blackburn and 
Marx [13] and Braiiner [14]). In contrast to Fitting we are here not interested only in S5 structures 
but in the more general case of K from which more constrained structures (such as S5) can be 
easily obtained. First order quantification can be constant domain or varying domain. Below we 
only consider the constant domain case: every possible world has the same domain. Like Fitting, 
we keep our definitions simple by not having function or constant symbols. While Fitting [16] 
studies quantified monomodal logic, we are interested in quantified multimodal logic. Hence, 
we introduce multiple D r operators for symbols r from an index set S. The grammar for our 
quantified multimodal logic QMC hence is 

s,t ::= P | k(X\...,X n ) | -n s \ s V t | VXs | VP.s | D r s 

where P denotes propositional variables, X, X 1 denote first-order (individual) variables, and k 
denotes predicate symbols of any arity. Further connectives, quantifiers, and modal operators 
can be defined as usual. We also obey the usual definitions of free variable occurrences and 
substitutions. 

Fitting introduces three different notions of Kripke semantics for QMC: QS57r~, QS57T, and 
QS57T+. In our work [10] we study related notions QK7r~, QK7r, and QK7r + for a modal context 
K, and we support multiple modalities. 

STT is an expressive logic and it is thus not surprising that QMC can be elegantly mod- 
eled and even automated as a fragment of STT. The idea of the encoding, called QMC STT , 
is simple. Choose type t to denote the (non-empty) set of individuals and we reserve a sec- 
ond base type \i to denote the (non-empty) set of possible worlds. The type o denotes the set 

2 This choice is not minimal (from = Q ^ Q ^ all other logical constants can already be defined [4]). It useful though 
in the context of resolution based theorem proving. 
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of truth values. Certain formulas of type fj, o then correspond to multimodal logic expres- 
sions. The multimodal connectives -i , V , and □ , become A-terms of types (/i -> o) -> (fj, -> o), 
(pL ->• o) -»• -> o) -> (fj, -> o), and (/x -> -> o) -> (// -> o) -> (/x -> o) respectively. 

Quantification is handled as in 5TT by modeling VX.p as H(\X..p) for a suitably chosen 
connective IT. Here we are interested in defining two particular modal II-connectives: 11', for 
quantification over individual variables, and n M ^°, for quantification over modal propositional 
variables that depend on worlds. They become terms of type (<<-»•(//-> o)) o) and 

((//-» o) -> (/u o) )->(//-> o) respectively. 

The Q.M£ 5TT modal operators -i , V , □, 11', and n M ^° are now simply defined as follows: 

V (^oM^oM^o) = A<^ . A^o- AW M . tpWVtpW 
□ (m^oM^oM^o) = Ai? M ^ o .A0^ o .AW /1 .VV r M .-(i?Wy) V c/)V 

n ( ( ;: oM ^ 0) M^o) = A0(^ o) .(^ o) .A^.vp^ o .0Pw 

Further operators can be introduced as usual, for example, T = AW M .T,_L = -i T, A = 
A0,^.^(^0 V -itj)), D= A0,^.^0 V tp, = \<f>,ip.((j> D A (tp D <f>), O = 
Ai2, (-.<£)), £ l = A0.-.n t (AX-.0X), = A0.-.n^°(AP.^0P). 

For defining Q.M£ -propositions we fix a set XV of individual variables of type t, a set 
VV of propositional variables 3 of type // -> o, and a set of n-ary (curried) predicate 

constants of types i -> (// -> o). Moreover, we fix a set S STT of accessibility relation 

n 

constants of type /i -> /i -> o. Q7W£ 5TT -propositions are now defined as the smallest set of 
iSTT-terms for which the following hold: 

• if P G VV STT , then P G Q.M£ 5rT 

• if X'' G JV 5TT (j = 1, . . . , n) and k G S y.M 5TT , then (fc X 1 . . . X n ) G QMC STT 

• if 0, -0 G QMC STT , then -. G Q.M£ STT and cp V ^ G QM£ STT 

• if r G 5 5TT and G Q7W£ STT , then □ r G Q7W£ STT . 

• if X G JV STT and G OM£ 5TT , then IT(AX0) G QM£ STT 

• if P G PV STT and G Q7W£ 5TT , then IF^°(AP.0) G Q7W£ STT 

We write D r for □ r 0, VX t .</» for TT(XX^<f>), and VP^ o .0 for IF"°(AP^ o .0). 

Note that the defining equations for our QM.C modal operators are themselves formulas in 
simple type theory. Hence, we can express QM.C formulas in a HO-ATP elegantly in the usual 
syntax. For example, U r 3P^ . P is a QMC STT proposition; it has type ^ o. 

Validity of QMC STT propositions is defined in the obvious way: a QMC -proposition (J)^ 
is valid if and only if for all possible worlds we have w G 4>^ , that is, if and only if 4>^ Q 
holds. Hence, the notion of validity is modeled via the following equation: 

mvalid= X^^^W^W 



3 Note that the denotation of propositional variables depends on worlds. 



5 



Now we can formulate proof problems in QMC , e.g., mvalid U r 3P^ Q . P. Using rewriting 
or definition expanding, we can reduce such proof problems to corresponding statements con- 
taining only the basic connectives -i , V , =, IP, and IP"" of STT. In contrast to the many 
other approaches no external transformation mechanism is required. For our example we get 
VW fl .VY' tl .—i(r W Y) V (nVI^„.n(iy)). It is easy to check that this term is valid in Henkin 
semantics: putX = XY^.T. 

We have proved soundness and completeness for this embedding [10]. 
Theorem 2.1 (Soundness) // \= srr (valid s^ ) then ^ QKn s. 
Theorem 2.2 (Completeness) If \=^ K7r s then \= STT (valid s^ a ). 

These results illustrate the natural correspondence between QK7r models and Henkin models. 
Moreover, we get the following corollaries. 

Corollary 2.3 The reduction of our embedding to propositional quantified multimodal logics 
(which only allow quantification over propositional variables) is sound and complete. 

Corollary 2.4 The reduction of our embedding to first-order multimodal logics ( which only allow 
quantification over individual variables) is sound and complete. 

Corollary 2.5 The reduction of our embedding to propositional multimodal logics (no quantifi- 
cation) is sound and complete. 

In the remainder of the paper we will usually omit type information. It is sufficient to remember 
that states are of type p, multimodal propositions of type ji -> o, and accessibility relations of 
type fi ji o. 
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3 A Case Study 

In this section we apply off the shelf reasoning systems for simple type theory to simple problems 
in and about quantified multimodal logics. Many of these examples have been adapted from 
Goldblatt's textbook [18]. Our problems are encoded in the new TPTP THF syntax [11] and our 
experiments exploit the new higher-order TPTP infrastructure [24]. The reasoning systems we 
apply are LEO-II (version 0.99a) [12], TPS (version 3.0) [1] and IsabelleP (version 2008) and 
IsabelleM (version 2008) of the Isabelle proof assistant [22]. 

LEO-II is a resolution based higher-order ATP system. LEO-II is implemented in Objective 
Caml, and is freely available under a BSD-like license. LEO-II is designed to cooperate with spe- 
cialist systems for fragments of higher-order logic. Currently, LEO-II is capable of cooperating 
with the first-order ATP systems E, SPASS, and Vampire. LEO-II directly parses THF0 input and 
communicates with the cooperating first-order ATP system using TPTP standards. 

TPS is a higher-order theorem proving system that has been developed under the supervision 
of Peter B. Andrews since the 1980s. Theorems can be proved either interactively or automat- 
ically. In TPS there are flags that can be set to affect the behavior of automated search. The 
automated TPS used for solving THF problems uses two different collections of flags, in modes 
called MS98-FO-MODE and BASIC-MS04-2-MODE. As the two modes have quite different 
capabilities, they are run in competition parallel as a simple way of obtaining greater coverage. 

Isabelle is normally used interactively. A fully automatic version, called IsabelleP, has been 
implemented using strategy scheduling of the nine automatic tactics simp, blast, auto, metis, fast, 
fastsimp, best, force, and meson. While it was probably never intended to use Isabelle as a fully 
automatic system, this simple automation provides useful capability. The ability of Isabelle to 
find (counter-) models using the refute tactic has also been integrated into an automatic system, 
called IsabelleM. 

The first interesting question clearly is whether our embedding QMC STT of quantified mul- 
timodal logic in simple type theory is consistent. The file in Attachment A contains the encoding 
of our embedding in TPTP THF syntax. The file also contains some further notions and concepts 
as will be introduced later in this paper. When applying the model generator IsabelleM to this in- 
put file, we receive in 0.7 seconds the answer that this set of definitions and axioms is satisfiable. 
Thus, IsabelleM confirms that our theory is consistent. 

All experiments were conducted with the SystemOnTPTP interface [23] which provides on- 
line access to the theorem pro vers running locally at computers at University of Miami. These 
pro vers were called remotely with a timeout of 200s. 
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Problem 


IsabelleP 


LEO-II 


TPS 


IsabelleM 


(1) 


THM(40.0) 


THM(O.O) 


THM(0.3) 


TMO 


(2) 


THM( 105.6) 


THM(O.O) 


THM(0.4) 


TMO 


(3) 


THM( 149.6) 


THM(O.O) 


THM(0.2) 


TMO 


(4) 


THM(123.8) 


THM(O.O) 


THM(0.3) 


TMO 


(5) 


TMO 


THM(O.l) 


THM(0.3) 


TMO 


(6) 


TMO 


THM(O.l) 


THM(0.2) 


TMO 



Table 1: 



3.1 Reasoning within Multimodal Logics 

We study whether some simple textbook examples can be automatically proved. 



Example 3.1 (cf. [18], Exercise 1.4) The following statements are valid (for all accessibility 
relations r). 



□rT (1) 

VA,B. D r (A D B) D (D r A D U r B) (2) 

VA,B. O r {A D B) D (D r A D O r B) (3) 

VA, B. n r (A D B) D (O r A D O r B) (4) 

\/A,B. U r (A A B) (D r A A U r B) (5) 

WA, B. O r (Av B) o (O r A V O r B) (6) 



The THF encoding of Example (3) is given in Appendix B. 

The results of our experiment are given in Table 1 . The table entries are to be interpreted as 
follows: THM(40.0) says that a problem was classified as 'theorem' within 40.0 seconds. TMO 
says that the prover was killed due to reaching the 'timeout' limit of 200 seconds. UKN specifies 
that the prover stopped proof search but without generating any classification result. CSA(0.8) 
(cf. Table 2) says that a problem was classified as counter-satisfiable in 0.8 seconds. 

The next set of examples is more challenging. These examples are about counter-satisfiable 
statements (in basic multimodal logic K). Proving them is non-trivial since the synthesis of ap- 
propriate accessibility relations R and propositions A, B are required. 4 



4 These examples are actually already belonging to the next subsection, since they rather illustrate the poten- 
tial of our systems for reasoning about multimodal logics than reasoning within them — the synthesis of concrete 
accessibility relations, for instance, is to the best of our knowledge not supported in traditional, direct approaches. 
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Example 3.2 (cf. [18], Exercise 1.5) The following propositions are not valid. 



VA U r A D A (7) 

VA U r A D U r U r A (8) 

VA,B.n r (A D B) D (D r A D O r B) (9) 

O r T (10) 

VAO r A D D r A (11) 

Vi4,S.D r (D r i4 D B) V D r (D r B D A) (12) 

VA,B.n r (A V £) D (D r A V n r B) (13) 

VAD r (D r A D A) D n r A (14) 



The encoding of these examples is analogous to the encoding of the previous ones. However, 
for each problem we also formulate a second question which asks whether there is an accessibility 
relation r such that the proposition is not valid. For instance, for Example 8 this second question, 
called problem (8a) below, is encoded as follows: 

% include the definitions for quantified multimodal logic 

include ( ' QML . ax' ) . 

% conjecture statement 

thf (con j , con jecture, ( 

? [R: mu > mu > $o] : 
~ ( mvalid 

@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ R @ A ) 

@ ( mbox @ R @ ( mbox @R@A) ) ) ) ) )). 

The results of this experiment are given in Table 2. Note that our provers generate the ex- 
pected results for examples (7),(7a),(9),(9a),(10),(10a),(14), and (14a), that is, the model finder 
IsabelleM finds a countermodel for Examples (7),(9),(10), and (14) and even the provers can 
show that there exists countermodels by proving the corresponding statements (7a),(9a),(10a), 
and (14a). 

For the remaining problems the task is more challenging though and we will illustrate this 
with the help of Example (8), the transitivity axiom. This axiom is not valid and correctly none 
of the theorem provers signals that a proof can be found. Unfortunately, the model generator 
IsabelleM does not generate a countermodel either. We thus try to prove (8a) which states that 
there is an accessibility relation R such that the transitivity axiom is invalidated. 

3R. (-ivalid VA (n R A D D R O r A)) 

We would expect that this statement can be quickly proved when instantiating variable R with a 
non-transitive relation. For good reasons our provers fail to do so. In fact, our provers also fail to 
prove the related statement 



3R. -i(transitive R) 
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Problem 


IsabelleP 


LEO-II 


TPS 


IsabelleM 


(7) 


TMO 


UKN 


TMO 


CSAd 6) 


(7a) 


THM(79.6) 


THM(62.4) 


THM(0.2) 


TMO 


(8) 


UKN 


UKN 


TMO 


TMO 


(8a) 


UKN 


TMO 


TMO 


CSAd 6) 


(9) 


UKN 


TMO 


TMO 


CSAd 7) 


(9a) 


UKN 


THM(64 9) 


THM(0.2) 


TMO 


(10) 


UKN 


UKN 


TMO 


CSAd 5) 


(10a) 


THM(78 9) 


THM(63.4) 


THM(0.2) 


TMO 


(11) 


UKN 


UKN 


TMO 


TMO 


(11a) 


TMO 


TMO 


UKN 


CSA(1.6) 


(12) 


TMO 


UKN 


TMO 


TMO 


(12a) 


UKN 


TMO 


TMO 


CSA(1.8) 


(13) 


UKN 


UKN 


TMO 


TMO 


(13a) 


UKN 


TMO 


TMO 


CSA(1.7) 


(14) 


UKN 


TMO 


TMO 


CSA(1.6) 


(14a) 


UKN 


THM(72.5) 


THM(8.6) 


TMO 



Table 2: 



The reason is that without further assumptions this statement is not a theorem. We have neither 
assumed the axiom of infinity nor that there exist at least two different possible worlds. Hence, 
our domain of possible worlds may well just consist of a single world w in which case a non- 
transitive accessibility relation cannot be provided. It is thus not surprising that IsabelleM finds a 
countermodel to statement (8a). Unfortunately, it does not succeed though to find a countermodel 
to the original problem. 
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3.2 Reasoning about Multimodal Logics 



The literature on modal logics is full of theorems and student exercises illustrating the relation- 
ships between properties of accessibility relations and corresponding axioms (respectively axiom 
schemata). Therefore, the question that interests us next is whether such meta-theoretic results 
can be automatically proved by our higher-order reasoners. We again study the examples given 
in Goldblatt's textbook [18]. First we encode various accessibility relation properties in simple 
type theory. 



reflexive 
symmetric 
serial 
transitive 
Euclidean 
partially _functional 
functional 
weakly_dense 
weakly _connected 

weakly _directed 



XR.\/S.RSS (15) 

\R.VS,T.(RST) (RTS) (16) 

\R.VS3T.(RST) (17) 

\R.VS,T,U.((RST) A (RTU)) ^(RSU) (18) 

\R.VS,T,U.((RST) A (RSU)) =>- (RTU) (19) 

\R.VS,T,U.((RST) A (RSU)) =>(T = U) (20) 

\R.VS.3T.(RST) AVU.(RSU) =>(T = U) (21) 

\R.VS,T.(RST) ^BU.(RSU) A (RUT) (22) 
\R.VS,T,U.((RST) A (RSU)) =>• 

((RTU)V (T = U)y (RUT)) (23) 
\RVS,T,U.((RST) A (RSU)) => 

BV.(RTV) A (RUV) (24) 



The formulation of these accessibility relation properties in THF syntax is straightforward, 
for example, 5 

thf (intransitive, definition, 
( intransitive 

= ( A [ R : mu > mu > $ o ] : ! [ S : mu , T : mu , U : mu ] : 

( ( (R @ S @ T) & (R @ T @ U) ) => (R @ S @ U) ) ) ) ) . 



The corresponding axioms are given next. 

VAa r A D A 
MA A D D r O r A 
VA O r A D O r A 
VA o r A d n r n r A 
VA O r A D D r O r A 
VA O r A D n r A 
VA O r A & O r A 
\JA.U r U r A D U r A 

VA,B.U r (A A (O r A D B)) V U r (B A (U r B D A)) 
VA O r U r A D U r O r A 



(25) 
(26) 
(27) 
(28) 
(29) 
(30) 
(3D 
(32) 
(33) 
(34) 



5 We have decided to use a prefix 'm' for all these example to avoid clashes of these definitions with inbuilt 
concepts in our reasoners using the same name. 
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Problem 


IsabelleP 


LEO-II 


TPS 


IsabelleM 


(1J) =r- 




THM(90.0) 


THM(O.O) 


THM(0.3) 


TMO 






THM( 113.7) 


THM(O.O) 


THM(0.2) 


TMO 




(21) 


THM( 102.1) 


THM(O.O) 


THM(0.3) 


TMO 




(29.) 


THM(123.2) 


THM(O.O) 


THM(8.1) 


TMO 




(29) 


THM(131.7) 


THM(O.O) 


THM(0.6) 


TMO 


(20') 
K^v) =?- 


no) 


THM( 125.8) 


THM(O.O) 


THM(l.l) 


TMO 


(2\ \ =b> 




THM( 156.3) 


THM(O.O) 


TMO 


TMO 


(22\ =± 


(12) 


THM(105.1) 


THM(0 0) 


THM(l.l) 


TMO 






THM(42.6) 


THM(0 0) 


THM(0.2) 


TMO 


(2d\ =b. 


(M) 


THM(178.1) 


THM(O.O) 


THM(0.2) 


TMO 


\YZ>) 


(ZD) 


THM(75 3) 


THM(0 0) 


THM(0.2) 


TMO 


(\f,\^= 
UOj v= 




UKN 


TMO 


THM(0 5) 


TMO 


(17) <= 


(27) 


THM(89 6) 


THM(0 0) 


THM(0 2) 


TMO 


(18)^ 


(28) 


TMO 


TMO 


TMO 


TMO 




(29) 


UKN 


TMO 


TMO 


TMO 


(20)*= 


(30) 


TMO 


THM(6.2) 


THM(47.9) 


TMO 


(21)^ 


(3D 


TMO 


TMO 


THM(151.3) 


TMO 


(22)<*= 


(32) 


TMO 


TMO 


TMO 


TMO 


(23)^ 


(33) 


UKN 


TMO 


TMO 


TMO 


(24)^ 


(34) 


THM(85.1) 


THM(O.l) 


THM(148.5) 


TMO 



Table 3: 

Example 3.3 (Correspondence of accessibility relation properties and axioms) 

Property k (k = (15), . . . , (24)) holds for accessibility relation r if and only if the corresponding 
axiom (k+10) is valid. 

As an example we present the encoding of problem (18) <= (28) in Appendix C. The outcome 
of this experiment is summarized in Table 3. Except for 4 out of the 20 problems our provers 
collectively are able to come up with the expected results. 
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3.3 Epistemic Reasoning 

In this section we encode epistemic reasoning problems in our framework. The examples are 
taken from Baldoni [5]. 

Example 3.4 (Epistemic reasoning: The friends puzzle) (i) Peter is a friend of John, so if Pe- 
ter knows that John knows something then John knows that Peter knows the same thing, (ii) Peter 
is married, so if Peter's wife knows something, then Peter knows the same thing. John and Peter 
have an appointment, let us consider the following situation: (a) Peter knows the time of their 
appointment, (b) Peter also knows that John knows the place of their appointment. Moreover, (c) 
Peter's wife knows that if Peter knows the time of their appointment, then John knows that too 
(since John and Peter are friends). Finally, (d) Peter knows that if John knows the place and the 
time of their appointment, then John knows that he has an appointment. 

From this situation we want to prove (e) that each of the two friends knows that the other one 
knows that he has an appointment. 

For the three persons in this puzzle, John, Peter and Peter's wife, we introduce corresponding 
accessibility relations john, peter, and wife(peter). For this example it is sufficient to require the 
S4 axioms, that is, a knowledge or truth axioms (cf. 25) and positive introspection axioms (cf. 28) 
for each accessibility relation. Alternatively, we here require that the accessibility relations john, 
peter, and wife( peter) axe reflexive and transitive. 

o 

O 

thf (peter, type, ( peter: mu > mu > $o ) ) . 
thf ( john, type, ( john: mu > mu > $o )). 

thf (wife, type, (wife : ( mu > mu > $o ) > mu > mu > $o )). 

o _ _ 

O 

thf (refl_peter, axiom, ( mreflexive @ peter )) . 
thf (refl_john, axiom, ( mreflexive @ john )) . 

thf (ref l_wif e_peter, axiom, ( mreflexive @ ( wife @ peter ))) . 
thf (trans_peter, axiom, ( mtransitive @ peter )) . 
thf (trans_john, axiom, ( mtransitive @ john)) . 

thf (trans_wife_peter, axiom, ( mtransitive @ ( wife @ peter ))) . 

It is clear that the following S4 axioms are implied by these conditions on the accessibility rela- 
tions (i ranges over wife(peter), peter, and john). 

K(i) = VA D t A 3 A T(i) = VA D t A D □,■ D t A 

We again use our reasoners to verify this. We only check this for K(wife(peter)) and T(wife(peter)); 
the results are given in Table 4. 

Next, we encode the facts from the puzzle. For (i) we provide a persistence axiom and for (ii) 
an inclusion axiom: 



VA dpeter '-'john A 3 Djohn '-'peter A 
VA d w ife(peter) A Z) Q peter A 



(35) 
(36) 
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Problem 


IsabelleP 


LEO-II 


TPS 


IsabelleM 


K(wife(peter)) 


THM(89.4) 


THM(O.O) 


THM(0.3) 


TMO 


T(wife(peter)) 


THM(178.3) 


THM(O.O) 


TMO 


TMO 


Example 3.4 


TMO 


THM(O.l) 


TMO 


TMO 


Example 3.5 


UKN 


THM(0.3) 


TMO 


TMO 



Table 4: 



Finally, the facts (a)-(d) and the conclusion (e) are encoded as follows (time, place, and appoint- 
ment are propositional constants, that is, constants of type i -> o in our framework): 



□p eter time (37) 

□peter Djohn Place (38) 

□wife(peter) (□peter time D □john time) (39) 

□peter □john (place A time D appointment) (40) 

□john □peter appointment A □john appointment (41) 



The THF encoding of the entire example is presented in Appendix D. Table 4 shows the results 
of our experiment. 



In the modeling of our next example we also follow Baldoni. 

Example 3.5 (Wise men puzzle) Once upon a time, a king wanted to find the wisest out of his 
three wisest men. He arranged them in a circle and told them that he would put a white or a 
black spot on their foreheads and that one of the three spots would certainly be white. The three 
wise men could see and hear each other but, of course, they could not see their faces reflected 
anywhere. The king, then, asked to each of them to find out the color of his own spot. After a 
while, the wisest correctly answered that his spot was white. 

The encoding of the example is presented in Appendix E and the performance of our provers 
shown in Table 4. For explanations on the modeling of this example we refer to [5] pp. 55-57. 
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4 Outlook 



This work presented in this paper has its roots in the LEO-II project (in 2006/2007 at Cam- 
bridge University) in which we first studied and employed the presented embedding of quantified 
multimodal logics in simple type theory [8] 6 . Subsequently, we have applied the idea also to 
propositional intuitionistic logics and to access control logics [6, 9]. And similar results are 
possible for various other non-classical logics that have been discussed in the literature. 

For example, to model temporal logic in our framework, we may fix particular accessibility 
relations relations past and future. Moreover, we require that both relations are transitive and 
mutually inverse. This can be easily done by stating: 



We may then introduce further temporal operators, for example, always and sometime (both 
in the past, at present, and in the future): 



The exploration of (quantified) temporal logic is future work. Future work also includes fur- 
ther extensions of our embedding to also cover quantified hybrid logics [13, 14] and full higher- 
order modal logics [17, 20]. A first suggestion in direction of higher-order modal logics has 
already been made [8]. This proposal does however not yet address intensionality aspects. How- 
ever, combining this proposal with non-extensional notions of models for simple type theory 
[7, 21] appears a promising direction. 

Our overall goal is to show that various interesting non-classical logics can be fruitfully mech- 
anized and partly automated in modern proof assistants with the help of our embedding. We also 
want to motivate the integration of our automatic higher-order reasoners in modern proof assis- 
tants as well as the development of further automated reasoning tools for classical higher-order 
logic. It is obvious that the existing reasoners should be significantly improved for fruitful appli- 
cation to challenge problems in practice. This seems not unreasonable though. Moreover, when 
working with our reasoners from within a proof assistant then the user may provide interactive 
help, for example, by formulating some lemmas or by splitting proof tasks in simpler subtasks. 
In this context it seems also useful that our reasoners produce proof objects in a standard proof 
representation format, e.g., in the TSTP format, and that a translation from this format into the 
proof representations used in the proof assistants is provided. 

Finally, it may be possible to formally verify the entire theory of our embedding within a 
proof assistant. 




(42) 
(43) 
(44) 



\/S, T. (past ST)& (future T S) 



always = AA Dp^ A A A A □future A 
sometime = A A O past A V A V Of uture A 



(45) 
(46) 



6 This paper was written in 2007. 
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A Modeling quantified multimodal logic in simple type theory 



% File 

% Domain 

% Problems 

% Version 

% English 

o. 
o 

% Ref s 

% Source 

% Names 

% Status 

% Rating 

% Syntax 

% Comments 



QML . ax 

Quantified multimodal logic 



Embedding of quantified multimodal logic in 
simple type theory 

Formalization in THF by C. Benzmueller 



% declaration of additional base type mu 

thf (mu, type, ( 

mu : $tType ) ) . 

% modal operators not, or, box, Pi 

thf (mnot, definition, 
( mnot 

= ( [Phi: mu > $o,W: mu] : 
~ ( Phi @ W ) ) ) ) . 

thf (mor, definition, 
( mor 

= ( [Phi: mu > $o,Psi: mu > $o,W: mu] : 
( ( Phi @ W ) 
I ( Psi @ W ) ) ) ) ) . 

thf (mbox, definition, 
( mbox 

= ( A [R: mu > mu > $o,Phi: mu > $o,W: mu] 
! [V: mu] : 

( ~ ( R @ W @ V ) 

I ( Phi @ V ) ) ) ) ) . 

thf (mall_ind, definition, 
( mall_ind 

= ( A [Phi: $i > mu > $o,W: mu] : 
! [X: $i] : 

( Phi @ X @ W ) ) ) ) . 

thf (mall_prop, definition, 
( mall_prop 

= ( [Phi: ( mu > $o ) > mu > $o,W: mu] : 
! [P: mu > $o] : 

( Phi @ P @ W ) ) ) ) . 



% further modal operators 

thf (mtrue, definition, 
( mtrue 

= ( A [W: mu] : $true ) ) ) 
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thf (mtrue, definition, 
( mfalse 
= ( mall_prop 

@ A [P: mu > $o] : 

( mnot @ mtrue ) ) ) ) . 

thf (mand, definition, 
( mand 

= ( A [Phi: mu > $o,Psi: mu > $o] : 

( mnot @ ( mor @ ( mnot @ Phi ) @ ( mnot @ Psi )))))). 

thf (mimpl, definition, 
( mimpl 

= ( A [Phi: mu > $o,Psi: mu > $o] : 

( mor @ ( mnot @ Phi ) @ Psi ) ) ) ) . 

thf (mequiv, definition, 
( mequiv 

= ( A [Phi: mu > $o,Psi: mu > $o] : 
( mand @ ( mimpl @ Phi @ Psi ) 

@ ( mimpl @ Psi @ Phi ) ) ) ) ) . 

thf (mdia, definition, 
( mdia 

= ( A [R: mu > mu > $o,Phi: mu > $o] : 

( mnot @ ( mbox @ R @ ( mnot @ Phi )))))). 

thf (mexi_ind, definition, 
( mexi_ind 

= ( A [Phi: $i > mu > $o] : 
( mnot 

@ ( mall_ind 
@ A [X: $i] : 

( mnot @ ( Phi @ X ) ) ) ) ) ) ) . 

thf (mexi_prop, definition, 
( mexi_prop 

= ( A [Phi: ( mu > $o ) > mu > $o] : 
( mnot 

@ ( mall_prop 

@ A [P: mu > $o] : 

( mnot @ ( Phi @ P ))))))) . 

o. 

o 

% temporal logic 

thf (past , type, ( 

past : mu > mu > $o ) ) . 

thf (future, type, ( 

future: mu > mu > $o ) ) . 

thf (past_transitive, axiom, 

( mtransitive @ past ) ) . 
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thf ( future_transitive, axiom, 

( intransitive @ future ) ) . 

thf (past_future, axiom, ( 
! [S: mu,T: mu] : 

( ( future @ S @ T ) 
<=> ( past @ T @ S ) ) ) ) . 

% definition of always 

thf (malways, definition, 
( malways 

= ( A [A: mu > $o] : 

( mand @ ( mand @ 
@ ( mbox @ 

% definition of sometime 

thf (msometime, definition, 
( msometime 
= ( A [A: mu > $o] : 

( mor @ ( mor @ ( mdia @ past @ A ) @ A ) 
@ ( mdia @ future @ A ) ) ) ) ) . 

o_ _ _ _ _ ______ ___ _ _ _ __ 

o 

% definition of validity 

thf (mvalid, definition, 
( mvalid 

= ( A [Phi: mu > $o] : 
! [W: mu] : 

( Phi @ W ) ) ) ) . 

% definition of satisfiability 

thf ( ms at isfi able, definition, 
( msatisfiable 
= ( A [Phi: mu > $o] : 
? [W: mu] : 

( Phi @ W ) ) ) ) . 

% definition of countersatisf iability 

thf (mcountersatisf iable, definition, 
( mcountersatisf iable 
= ( A [Phi: mu > $o] : 
? [W: mu] : 

~ ( Phi @ W ) ) ) ) . 

% definition of invalidity 

thf (minvalid, definition, 
( minvalid 

= ( A [Phi: mu > $o] : 
! [W: mu] : 

~ ( Phi @ W ) ) ) ) . 



( mbox @ past @ A ) @ A ) 
future @ A ) ) ) ) ) . 



o, 

o 

% definition of properties of accessibility relations 

thf (mref lexive, definition, 
( mreflexive 
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= ( A [R:mu>mu>$o] : 
! [S: mu] : 

( R @ S @ S ) ) ) ) . 

thf (msymmetric, definition, 
( msymmetric 

= ( A [R:mu>mu>$o] : 
! [S: mu,T: mu] : 
( ( R @ S @ T ) 
=> (R@T@S) ) ) )). 

thf (mserial, definition, 
( mserial 

= ( A [R:mu>mu>$o] : 
! [S: mu] : 
? [T: mu] : 

( R @ S @ T ) ) ) ) . 

thf (mtransitive, definition, 
( mtransitive 
=( A [R:mu>mu>$o] : 

! [ S : mu , T : mu , U : mu ] : 
( ( ( R @ S @ T ) 
& ( R @ T @ U ) ) 
=> (R@S@U) ) ) )). 

thf (meuclidean, definition, 
( meuclidean 

= ( A [R:mu>mu>$o] : 

! [S: mu,T: mu,U: mu] : 
( ( ( R @ S @ T ) 
& ( R @ S @ U ) ) 
=> (R@T@U) ) ) )). 

thf (mpartially_functional, definition, 
( mpartially_f unctional 
= ( A [R: mu > mu > $o] : 

! [S: mu,T: mu,U: mu] : 
( ( ( R @ S @ T ) 
& ( R @ S @ U ) ) 
=> ( T = U ) ) ) ) ) . 

thf (mfunctional, definition, 
( mfunctional 
= ( A [R:mu>mu>$o] : 
! [S: mu] : 
? [T: mu] : 

( ( R @ S @ T ) 

& ! [U: mu] : 

( ( R @ S @ U ) 

=> ( T = U ) ) ) ) ) ) . 

thf (mweakly_dense, definition, 
( mweakly_dense 
= ( A [R: mu > mu > $o] : 

! [ S : mu , T : mu , U : mu ] : 
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( ( R @ S @ T ) 
=> ? [U: mu] : 

( ( R @ S @ U ) 

& (R@U@T) ) ) ) )) 

thf (mweakly_connected, definition, 
( mweakly_connected 
= ( A [R:mu>mu>$o] : 

! [ S : mu , T : mu , U : mu ] : 
( ( ( R @ S @ T ) 
& ( R @ S @ U ) ) 
=> ( ( R @ T @ U ) 
I ( T = U ) 

( R @ U @ T ) ) ) ) ) ) . 

thf (mweakly_directed, definition, 
( mweakly_directed 
= ( A [ R : mu > mu > $ o ] : 

! [ S : mu , T : mu , U : mu ] : 
( ( ( R @ S @ T ) 
& ( R @ S @ U ) ) 
=> ? [V: mu] : 

( ( R @ T @ V ) 

& (R@U@V) ) ) ) )) 
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B A simple problem encoding 

a. _ __ _ 

o 

% File : 

% Domain : 

% Problems : 

% Version : 

% English : 

% Refs : 

% Source : Formalization in THF by C. Benzmueller 

% Names : 

% Status : 

% Rating : 

% Syntax : 

% Comments : 

o. _ 

o 

% include the definitions for quantified multimodal logic 

include ( ' QML . ax' ) . 



% conjecture statement 

thf (con j , con jecture, ( 

! [ R : mu > mu > $ o ] : 
( mvalid 
@ ( mall_prop 

@ A [A: mu > $o] : 
( mall_prop 
@ A [B: mu > $o] : 

( mimpl @ ( mdia @ R @ ( mimpl @ A @ B ) ) 
@ ( mimpl @ ( mbox @ R @ A ) 

@ ( mdia @R@B) ) ) ) ) ) )). 
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C Correspondence between accessibility relation properties and 
modal axioms 

o, 

o 

% File : 
% Domain : 
% Problems : 
% Version : 
% English : 
% Refs : 

% Source : Formalization in THF by C. Benzmueller 

% Names : 

% Status : 

% Rating : 

% Syntax : 

% Comments : 

g 

o 

% include the definitions for quantified multimodal logic 

include ( ' QML . ax' ) . 

conjecture statement 

thf (con j, con jecture, ( 

! [R: mu > mu > $o] : 
( ( mvalid 

@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ R @ A ) 

@ ( mbox @ R @ ( mbox @ R @ A ) ) ) ) ) 
=> ( mtransitive @ R ) ) ) ) . 
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D A simple example in epistemic logic 

a. __ _ _ 

o 

% File : 

% Domain : 

% Problems : 

% Version : 

% English : 

% Refs : 

% Source : Formalization in THF by C. Benzmueller 

% Names : 

% Status : 

% Rating : 

% Syntax : 

% Comments : 

o 

% include the definitions for quantified multimodal logic 

include ( ' QML . ax' ) . 

o. 

o 

thf (peter , type, ( 

peter: mu > mu > $o ) ) . 

thf ( john, type, ( 

john: mu > mu > $o ) ) . 

thf (wife, type, ( 

wife: ( mu > mu > $o ) > mu > mu > $o ) ) . 



thf (ref l_peter, axiom, 

( mreflexive @ peter ) ) . 

thf (ref l_john, axiom, 

( mreflexive @ john ) ) . 

thf (ref l_wif e_peter, axiom, 

( mreflexive @ ( wife @ peter ) ) ) . 

thf (trans_peter , axiom, 

( mtransitive @ peter ) ) . 

thf (trans_john, axiom, 

( mtransitive @ john ) ) . 

thf (trans_wif e_peter , axiom, 

( mtransitive @ ( wife @ peter ) ) ) . 



thf (ax_i, axiom, 
( mvalid 
@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ peter @ ( mbox @ john @ A ) ) 

@ ( mbox @ john @ ( mbox @ peter @ A ) ) ) ) ) ) . 
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thf (ax_ii, axiom, 
( mvalid 
@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ ( wife @ peter ) @ A ) 
@ ( mbox @ peter @ A ) ) ) ) ) . 

thf (time, type, ( 

time : mu > $o ) ) . 

thf (place, type, ( 

place : mu > $o ) ) . 

thf (appointment, type, ( 

appointment: mu > $o ) ) . 

thf (ax_a, axiom, 

( mvalid @ ( mbox @ peter @ time ) ) ) . 

thf (ax_b, axiom, 

( mvalid @ ( mbox @ peter @ ( mbox @ john @ place ) ) ) ) . 

thf (ax_c, axiom, 

( mvalid @ ( mbox @ ( wife @ peter ) 

@ ( mimpl @ ( mbox @ peter @ time ) 

@ ( mbox @ john @ time ) ) ) ) ) 

thf (ax_d, axiom, 
( mvalid @ 

( mbox @ peter 

@ ( mbox @ john 

@ ( mimpl @ ( mand @ place @ time ) 
@ appointment ) ) ) ) ) . 

thf (conj, conjecture, 
( mvalid @ 

( mand @ ( mbox @ peter 

@ ( mbox @ john @ appointment ) ) 
@ ( mbox @ john 

@ ( mbox @ peter @ appointment ) ) ) ) ) . 
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E Wise men puzzle 



o. 








"6 


File 




g, 




Domain 




g, 




Problems 


Wise men puzzle 


o. 






g, 




English 




o, 




Ref s 


Matteo Baldoni, Normal Multimodal Logics: Automatic 


g, 






Deduction and Logic Programming Extension, Phd thesis, 


g, 






Universita degli studi di Torino, 2003, pp. 55-57 


g, 




Source 


Formalization in THF by C. Benzmueller 


"6 


Names 




g, 




Status 




g, 




Rating 




"6 


Syntax 




g, 




Comments 




g, 









% include the definitions for quantified multimodal logic 

include ( ' QML . ax' ) . 



thf (a, type, ( 

a : mu > mu > $ o ) ) . 

thf (b, type, ( 

b : mu > mu > $ o ) ) . 

thf (c, type, ( 

c : mu > mu > $ o ) ) . 

thf (fool, type, ( 

fool : mu > mu > $o ) ) . 

thf (ws, type, ( 

ws : ( mu > mu > $o ) > mu > $o ) ) 



thf (axiom_l , axiom, 
( mvalid @ ( mbox @ fool @ 

( mor @ ( ws @ a ) @ ( mor @ ( ws @ b ) @ ( ws @ c ) ) ) ) ) ) 



thf (axiom_2_a_b, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ a ) @ ( mbox @b@ (ws@a) ) ) ) )) 

thf (axiom_2_a_c, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ a ) @ ( mbox @c@ (ws@a) ) ) ) )) 

thf (axiom_2_b_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ b ) @ ( mbox @a@ (ws@b) ) ) ) )) 

thf (axiom_2_b_c, axiom, 
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( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ b ) @ ( mbox @c@ (ws@b) ) ) ) )). 

thf (axiom_2_c_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ c ) @ ( mbox @a@ (ws@c) ) ) ) )). 

thf (axiom_2_b_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( ws @ c ) @ ( mbox @b@ (ws@c) ) ) ) )). 



thf (axiom_3_a_b, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ a ) ) 

@ ( mbox @ b @ ( mnot @ ( ws @ a ) ) ) ) ) ) ) 

thf (axiom_3_a_c, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ a ) ) 

@ ( mbox @ c @ ( mnot @ ( ws @ a ) ) ) ) ) ) ) 

thf (axiom_3_b_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ b ) ) 

@ ( mbox @ a @ ( mnot @ ( ws @ b ) ) ) ) ) ) ) 

thf (axiom_3_b_c, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ b ) ) 

@ ( mbox @ c @ ( mnot @ ( ws @ b ) ) ) ) ) ) ) 

thf (axiom_3_c_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ c ) ) 

@ ( mbox @ a @ ( mnot @ ( ws @ c ) ) ) ) ) ) ) 

thf (axiom_3_b_a, axiom, 
( mvalid @ ( mbox @ fool @ 

( mimpl @ ( mnot @ ( ws @ c ) ) 

@ ( mbox @ b @ ( mnot @ ( ws @ c ) ) ) ) ) ) ) 



thf (t_axiom_f or_f ool , axiom, 
( mvalid 
@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ fool @ A ) @ A ) ) ) ) . 

thf (k_axiom_for_fool, axiom, 
( mvalid 
@ ( mall_prop 

@ A [A: mu > $o] : 

( mimpl @ ( mbox @ fool @ A ) 

@ ( mbox @ fool @ ( mbox @ fool @ A ) ) ) ) ) ) . 
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thf (i_axiom_f or_f ool_a, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ fool @ Phi ) 

@ ( mbox @ a @ Phi ) ) ) ) ) . 

thf (i_axiom_f or_f ool_b, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ fool @ Phi ) 

@ ( mbox @ b @ Phi ) ) ) ) ) . 

thf ( i_axiom_f or_f ool_c, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ fool @ Phi ) 

@ ( mbox @ c @ Phi ) ) ) ) ) . 



thf (a7_axiom_f or_f ool_a_b, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ a @ Phi ) 

@ ( mbox @ b @ ( mbox @ a @ Phi )))))) 



thf (a7_axiom_f or_f ool_a_c, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ a @ 
@ ( mbox @ c @ 



Phi ) 

( mbox @ a @ Phi ) 



) ) ) ) ) 



thf (a7_axiom_f or_f ool_b_a, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ b @ Phi ) 

@ ( mbox @ a @ ( mbox @ b @ Phi 



) ) 



thf (a7_axiom_f or_f ool_b_c, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ b @ Phi ) 

@ ( mbox @ c @ ( mbox @ b @ Phi )))))) 



thf (a7_axiom_f or_f ool_c_a, axiom, 
( mvalid 
@ ( mall_prop 

@ A [Phi: mu > $o] : 

( mimpl @ ( mbox @ c @ 
@ ( mbox @ a @ 



Phi ) 

( mbox @ c @ Phi 



)))))) 
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thf (a7_axiom_f or_f ool_c_b, axiom, 
( mvalid 
@ ( mall_prop 

@ [Phi: mu > $o] : 

( mimpl @ ( mbox @ c @ Phi ) 

@ ( mbox @ b @ ( mbox @ c @ Phi )))))). 

o. 

o 

thf (a6_axiom_f or_f ool_a_b, axiom, 
( mvalid 
@ ( mall_prop 

@ ^ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ a @ Phi ) ) 

@ ( mbox @ b @ ( mnot @ ( mbox @ a @ Phi ))))))). 

thf (a6_axiom_f or_f ool_a_c, axiom, 
( mvalid 
@ ( mall_prop 

@ ^ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ a @ Phi ) ) 

@ ( mbox @ c @ ( mnot @ ( mbox @ a @ Phi ))))))). 

thf (a6_axiom_f or_f ool_b_a, axiom, 
( mvalid 
@ ( mall_prop 

@ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ b @ Phi ) ) 

@ ( mbox @ a @ ( mnot @ ( mbox @ b @ Phi ))))))). 

thf (a6_axiom_f or_f ool_b_c, axiom, 
( mvalid 
@ ( mall_prop 

@ ^ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ b @ Phi ) ) 

@ ( mbox @ c @ ( mnot @ ( mbox @ b @ Phi ))))))). 

thf (a6_axiom_f or_f ool_c_a, axiom, 
( mvalid 
@ ( mall_prop 

@ ^ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ c @ Phi ) ) 

@ ( mbox @ a @ ( mnot @ ( mbox @ c @ Phi ))))))). 

thf (a6_axiom_f or_f ool_c_b, axiom, 
( mvalid 
@ ( mall_prop 

@ [Phi: mu > $o] : 

( mimpl @ ( mnot @ ( mbox @ c @ Phi ) ) 

@ ( mbox @ b @ ( mnot @ ( mbox @ c @ Phi ))))))). 

g 

o 

thf (axiom_4 , axiom, 

( mvalid @ ( mnot @ ( mbox @a@ (ws@a) ) ) )). 



thf (axiom_5, axiom, 
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( mvalid @ ( mnot @ ( mbox @b@ (ws@b) ) ) )). 



thf (con j, conjecture, 

( mvalid @ ( mbox @c@ (ws@c) ) )). 



